Skip to content
OpenAdvisories

Archive

13 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /13 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.4
    CVE-2025-36752

    Undocumented backup Account and No Password Configuration Capability

    Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backd…

    Growatt ShineLan-X
  • Critical 9.4
    CVE-2025-36747

    Hardcoded FTP Credentials within the firmware

    ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own…

    Growatt ShineLan-X
  • Critical 9.3
    CVE-2025-36754

    Authentication bypass on web interface

    The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for…

    Growatt ShineLan-X
  • Critical 9.4
    CVE-2025-36751

    Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X

    Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.

    Growatt ShineLan-X
  • Critical 9.8
    CVE-2025-10738

    URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection

    The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati…

    rupok98 URL Shortener Plugin For WordPress Web / CMS
  • Critical 9.8
    CVE-2025-11693 Scanner template

    Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File

    The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for u…

    Recorp Export WordPress Pages to Static HTML & PDF — Static Site Export Web / CMS
  • Critical 9.8
    CVE-2025-14440 Public exploit

    JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

    The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_regist…

    jayarsiech JAY Login & Register Web / CMS